The present invention relates to information technology, and more specifically, to techniques for managing changes to information technology infrastructure. Linking information technology service incident tickets to relevant information technology change tickets, or more generally linking incidents to changes, is a hard problem due to lack of documented historical change-incident pairs. However, even when it is possible to reliably link incidents to the changes that caused them, due to the complexity and high dimensionality of change and incident data, it is often difficult to discover and visualize complex trends and implicit relationships between the incident and change domains beyond simple summarizing statistics.